CVE-2026-48060

Name of the Vulnerable Software and Affected Versions Litestar version 2.21.0

Description Instances using a template engine (such as Jinja, Mako, or MiniJinja) in conjunction with CSRF protection are susceptible to HTML Injection. This occurs when the application is configured to include CSRF inputs in hidden form fields, as the contents of the csrftoken cookie are excluded from automatic escaping by the template engine. An attacker can poison the csrftoken cookie with malicious HTML or script tags, which are then rendered in the victim's browser. This can be escalated to Cross Site Scripting (XSS), potentially leading to the theft of session tokens, cookies, or the execution of phishing attacks by altering the site's appearance.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.